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Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was established by 
the Homeland Security Act of 2002 (Public Law 107-296) by amendment to the Inspector General 
Act of 1978. This is one of a series of audit, inspection, and special reports prepared by our office as 
part of our oversight responsibilities to promote economy, efficiency, and effectiveness within the 
department. 

This review was conducted at the request of Congressman Don Young, Chairman, Committee on 
Transportation and Infrastructure, U.S. House of Representatives. We assessed the Transportation 
Security Administration's (TSA) oversight of its ITMS contract with Unisys Corporation. Our 
report is based on interviews with employees and officials of relevant agencies and institutions, 
direct observations, and a review of applicable documents. 

The recommendations herein have been developed to the best knowledge available to our office, and 
have been discussed in draft with those responsible for implementation. It is our hope that this 
report will result in more effective, efficient, and economical operations. We express our 
appreciation to all of those who contributed to the preparation of this report. 




Richard L. Skinner 
Inspector General 
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Executive Summary 



The Office of Inspector General (OIG) reviewed Transportation Security 
Administration's (TSA) contract with Unisys Corporation (Unisys) for 
Information Technology Managed Services (ITMS) in response to a request from 
Congressman Don Young, Chairman, Committee on Transportation and 
Infrastructure, U.S. House of Representatives. Specifically, Congressman Young 
requested answers to the following questions: 

1. How are the contract and related task orders set up, including how much the 
government has paid and what services and/or products have been received? 

2. How do those actual services and products received compare to what was 
planned? 

3. How is contractor performance under these task orders measured and how is 
the contractor performing under these measures? 

4. How does TSA ensure appropriate use of small businesses? 

5. How does TSA ensure appropriate use of new technology through this 



In 2002, TSA started the rollout of security operations at airports under 
congressionally mandated short timeframes with significant budget constraints. 
To quickly establish an information technology and telecommunication 
infrastructure needed to support its employees at headquarters and airport 
locations across the United States, TSA awarded a $1 billion contract to Unisys 
using a broad statement of objectives to describe the requirements. At the time of 
award, the TSA Office of Information Technology (OIT) and Contracting Office 
had small staffs overseeing numerous high value acquisitions, including the 
Unisys contract. 

By the beginning of Fiscal Year (FY) 2006, TSA spent most of the contract 
ceiling without receiving many of the contract deliverables critical to airport 
security and communications. The following discussion references the questions 
posed by Congressman Young. 

1 . Contract Cost and Structure - TSA' s OIT projected that, by the beginning 
of FY 2006, its total costs on the Unisys contract would exceed $834 million. 
The original contract including option years was to run through FY 2009; 
therefore, 83 percent of the contract ceiling has been expended in less than 
half of the allotted time. TSA awarded a Statement of Objectives (SOO) 1 



contract? 



1 Under a Statement of Objectives (SOO) contract, the government describes its requirement in terms of desired objectives. 
Contractors are then asked to propose solutions that they believe will best meet or exceed the objectives. 



contract in August 2002, but did not receive FY 2003 funding at anticipated 
levels. OIT issued numerous requests for specific tasks and deliverables, but 
did not always ensure that technical proposals included all of the required 
contracting elements such as statements of work with delivery due dates and 
acceptance criteria. 

2. Planned Versus Actual Costs and Deliverables - Although actual contract 
costs exceeded planned contract costs, TSA did not receive all planned 
contract deliverables. TSA attributed most of its setbacks to budget cuts, 
understaffing, and changing or increasing requirements. TSA officials said 
that they originally estimated that the contract could exceed $3-5 billion, but 
set the contract ceiling at $1 billion. In its response to our draft report, TSA 
said that the $1 billion ceiling was based on specific requirements but could 
not document which specific requirements. 

3. Performance Measures and Contract Performance - TSA did not have 
adequate performance measures on the Unisys contract two years into the 
contract. Performance measures have evolved and improved over the life of 
the contract through TSA's efforts to improve them, but performance 
measures were limited to a small portion of contract work and were added too 
late in the contract cycle to be effective in assessing the contractor's 
performance. 

4. Appropriate Use of Small Business - Unisys use of small businesses is 
appropriate. TSA has taken an aggressive approach to ensure that Unisys 
complies with small business subcontractor management responsibilities. 

5. Appropriate Use of New Technology - TSA did not provide airport Federal 
Security Directors (FSDs) with all of the high-speed connections needed to 
obtain and transfer data and email necessary for their business operations. 
FSDs told us they were dissatisfied with the low level of technology in the 
equipment provided by TSA. 

In our draft report, we recommended that TSA terminate the current contract at 
the end of the base period and re -bid the contract, and implement procedures to 
ensure that future contracts are procured with proper controls. TSA concurred 
with the recommendations and has developed a new acquisition strategy for 
information technology services. This strategy identified some work previously 
performed by Unisys for immediate competition, and allows for future 
competition as opportunities are identified. On December 30, 2005, TSA 
awarded a 'bridge' contract to Unisys that allows it to retain equipment leased 
under the current ITMS contract, and provide for the transition of ongoing 
projects. TSA said that the 'bridge' contract implements sound business practices 
and processes to address the weaknesses identified in our report. We consider 
the recommendations resolved and closed based on TSA's assurances that these 
actions are complete. 
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Background 

The Aviation and Transportation Security Act, Public Law 107-71, established 
TSA as a component of the Department of Transportation (DOT). The Act 
mandated an aggressive schedule to rollout new security operations across 429 
airports nation-wide by November 2002. To accomplish this rollout, TSA needed 
to establish information technology and telecommunication infrastructure support 
and managed services for its anticipated 65,000 employees at headquarters, as 
well as 429 airports, 21 field offices, the TSA Command Center, and other 
locations to be determined. In August 2002, TSA used a streamlined acquisition 
strategy to award a $1 billion ITMS contract to Unisys. 

The most basic Unisys deliverable, High Speed Operational Connectivity 
(HSOC), provides the foundation for information technology capabilities. OIT 
defined this deliverable in three phases: 

• Red Package, "Getting TSA Started" - This package included dial up 
connectivity, laptops, pagers, and cell phones that served as the foundation 
for TSA's capabilities. Unisys was to complete this delivery by 
November 19, 2002. 

• White Package (now known as HSOC), "Making IT Functional" - This 
package included high-speed data connectivity, phone systems, integrated 
scheduling, encrypted radios, and the Electronic Surveillance System. Unisys 
was to complete this delivery by December 31, 2002. 

• Blue Package, "Optimizing IT" - This package included Airport Command 
Centers, advanced wireless applications, integration with DHS applications, 
and Land Mobile Radios (LMR) interoperability. TSA did not give Unisys a 
specific due date to complete this package. 

As of September 30, 2004, Unisys had fully delivered the Red Package but not 
the White Package. Due to funding constraints, TSA was unable to begin 
implementation of the Blue Package. 
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1. Contract Cost and Structure - How are the contract and related task orders set 
up, including how much the government has paid and what services and/or 
products have been received? 



TSA's OIT projected that, by the beginning of FY 2006, its total costs on the 
Unisys contract would exceed $834 million 2 . The procurement began as a SOO 
contract, but TSA managed it using the Service Request (SR) process to 
accomplish specific tasks. However, the SR technical proposals did not always 
include all of the required contracting elements such as statements of work with 
delivery due dates and acceptance criteria. As a result, TSA had no assurance that 
costs for Unisys deliverables were fair and reasonable; Unisys was sometimes 
allowed to perform unauthorized contract work; and TSA did not effectively 
manage its project priorities. 

Contract Costs 

TSA's projected total expenditures consisted of $456 million in incurred costs 
and $378 million to complete on-going projects. Contract obligations as of July 
15, 2005, were $763 million. Total contract obligations do not include equipment 
transition-to-ownership costs. TSA is leasing all equipment under this contract 
from Unisys. The contract calls for government buy-out of this equipment should 
TSA decide to cancel the contract. The buy-out fees decrease over time as the 
seven-year contract period progresses. 

The original contract including option years was to run through FY 2009. 
Therefore, spending $834 million would mean that 83 percent of the contract 
ceiling had been expended in less than half of the allotted time. TSA attributed 
this accelerated spending to continually changing and increasing Information 
Technology (IT) requirements. TSA officials stated that the staffing levels and 
geographic complexity of the technology required to secure the entire nation's 
transportation system were largely undefined when TSA was established and the 
ITMS Acquisition Plan was approved. Planned costs compared to actual costs are 
discussed in more detail in the next section. 

Contract Structure 

TSA requested proposals from contractors on a DOT "Information Technology 
Omnibus Procurement II (ITOP II) Government Wide Agency Contract 
(GWAC)," which included previously negotiated hourly rates. DOT had 
determined that the ITOP II labor prices were fair and reasonable. 



2 OIT reported that total costs through FY 2005 would be approximately $940 million, reflecting an additional $106 million 
in DHS work order costs that would be obligated and incurred on the Unisys contract by the end of FY 2005. These DHS 
costs count towards the contract ceiling of $1 billion, but do not affect TSA's contract obligations because they were funded 
by DHS. 



TSA's Information Technology Managed Services Contract 
Page 4 



TSA opted to issue a request for proposal (RFP) for a SOO contract instead of 
the more common SOW contract. TSA personnel said that this type of contract 
could help them to meet the time constraints Congress imposed to establish the 
IT infrastructure of the new agency, particularly when TSA did not know exactly 
what its IT requirements would encompass. In response to the draft report, TSA 
said that it had selected a SOO contracting approach after performing market 
research. The Acquisition Plan stated: 

"Under a SOO, the government describes its requirement in terms of 
desired objectives. Contractors will be asked to propose solutions that 
they believe will best meet or exceed the objectives. In essence, the 
government states the problem it wants solved, and industry is offered 
the freedom to propose what they consider the best solution. Under a 
SOO, the government is changing the very nature of what it is 
acquiring from the traditional compliance with a Government 
developed SOW, to performance results." 

TSA defined 1 1 contract objectives and asked the bidding contractors to define 
how they planned to meet those objectives. TSA awarded the contract to Unisys 
in August 2002 as a SOO contract with two work orders for information 
technology managed services at 429 airports and TSA headquarters, with an 
estimated 65,000 employees. The Unisys contract is an "Indefinite Delivery 
Indefinite Quantity SOO" contract with a base period of three years, two-year 
option periods (two), a $1 billion ceiling, and provisions for Firm-Fixed-Price, 
Cost-Plus-Fixed-Fee, Cost-Plus-Award-Fee, Time-and-Materials, and Fixed- 
Price- A ward-Fee type work orders. 

As the contract progressed, TSA managed the specific contract requirements by 
issuing SRs with specific tasks. TSA did not, however, ensure that SR technical 
proposals included all required contracting elements such as statements of work 
with delivery due dates and acceptance criteria. When OIT did not receive FY 
2003 funding at anticipated levels, it pulled smaller portions of work from the 
two large original work orders to fit with the funding levels provided. The 
contract expanded at that point into 1 1 work orders with hundreds of SRs, 
representing individual projects that were essentially more defined subsets of the 
original SOO. Appendix B describes the 11 work orders. 

Fair and Reasonable Pricing 

TSA did not adequately determine price reasonableness for individual projects. 
Even though it determined that the initial hourly rates were fair and reasonable, 
TSA often failed to determine that the number of hours charged or the labor 
categories used were reasonable or justifiable. Unisys submitted cost proposals to 
TSA for individual SRs using these hourly rates. However, only 7 of 27 SR 
contracting files reviewed contained evidence of price reasonableness 
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determinations or independent cost estimates. Federal Acquisition Regulation 
(FAR) 15.402 (a) requires that contracting officers purchase supplies and 
services at fair and reasonable prices. According to FAR 15.403-3 (a) (1), 
contracting officers are responsible for obtaining information that is adequate for 
evaluating the reasonableness of contract prices. We interviewed TSA OIT 
program managers to ask how they determined fair and reasonable pricing. 
Often, these officials cited the originally negotiated labor prices as their main 
justification for determining price reasonableness. In fact, the few program 
managers who closely examined Unisys' cost proposals found that many times 
Unisys proposed too many hours and higher labor categories than necessary for 
the described scope of work. In these cases, TSA successfully negotiated lower 
prices. 

Further, TSA requested several audits of the Unisys contract from the Defense 
Contract Audit Agency (DCAA). A TSA contracting official told us, "our office 
reached out to DCAA in order to gain some assistance, an independent 
assessment of the issues we saw. . . to rectify the issues we have faced [with 
Unisys] on a long term basis." DCAA reported pricing and billing problems. For 
example, on January 4, 2005, it concluded that: 

• Unisys' actual fully burdened rates were lower than the negotiated ITOP II 
rates, which indicated higher profit margins than 8.5 percent contemplated by 
the ITMS contract. 

• Unisys billed the Functional Subject Matter Expert labor category rates, 
which were the highest rates among all 25 ITOP II rates, for employees who 
did not have the requisite knowledge and expertise. 

• Unisys may have realized additional profit by billing uncompensated labor 
hours that were not reflected in the proposed base labor rates used to build up 
the ITOP II rates. 

• The ITOP II fully burdened rates were not representative of the actual 
performance of the ITMS contract because Unisys used entirely different 
subcontractors and fewer subcontract labor hours than initially proposed for 
the ITOP II rates. 

TSA reported that it has formed an Implementation Planning Team and is 
working with Unisys to correct the issues identified in the DCAA audit reports. 

Unauthorized Contract Work 

Unisys repeatedly performed work under the contract without receiving 
authorizations to proceed (ATP) from TSA's contracting office. TSA is partially 
responsible for this occurrence because OIT officials asked Unisys to begin work 
without signed ATPs. Unisys performed work before receiving an ATP on 13 of 



3 DCAA Report Number 632 1-2004U 17900002. 
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27 SRs reviewed. In one case, Unisys completed most of the work on a project 
before TSA's contracting office signed an ATP. In another instance, TSA refused 
to pay Unisys for unauthorized work. Working without an ATP is referred to as 
working "at risk." TSA is aware of this problem and has investigated it through 
its Internal Affairs office. TSA's legal office is aware of this problem, too, and 
warned OIT about continuing to allow Unisys to work at risk. On numerous 
occasions, TSA's contracting officer attempted to prevent Unisys from working 
at risk. For example, TSA's contracting officer sent the following e-mail to 
Unisys: 

"Unisys was not authorized to perform work under this SR; therefore, 
Unisys should not have provided any services under this SR to date 
for which Unisys expected reimbursement. For this reason the 
proposed $26,190 in Senior Program Manager costs are not 
accepted." 

The Summary of Procurement Action on the same SR stated: 

"Unisys has been repeatedly told by the contracting officers assigned 
to this contract that they shall not expect reimbursement for costs if 
they were not expressly directed by the contracting officer to perform 
work. It is the contracting officer's recommendation that the period of 
performance of this SR be the date the SR is accepted through 
September 30, 2004, and that Unisys be notified that all costs incurred 
from the start date shall be denied. Given that Unisys is a repeat 
offender on this issue, there is little hope that Unisys will instill more 
discipline without being financially penalized for failing to recognize 
the contracting officer as the only Government representative 
authorized to direct work." 

Contract files contained numerous other examples of warnings to Unisys about 
working at risk. In the most costly example, Unisys requested over $40 million 
for work it performed without an ATP. After two lengthy negotiations, TSA 
agreed to pay $15 million for the unauthorized work. 

Ineffective Project Prioritization 

Changing priorities caused delays in deploying fundamental projects to airports 
such as HSOC. Shifting priorities between projects appears to have caused some 
of OIT's contract management problems, too. Program managers reported that 
they were often frustrated by these shifts, which transferred funds from one 
project to another. At the end of FY 2004, TSA reprioritized its projects, moving 
HSOC back to the top of the list. (See Table 1, p. 10, for more detail.) 

TSA attributed the problems identified in this report to staffing constraints and 
noted that the original staffing level for OIT was only 94 full-time equivalent 
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(FTE) positions. TSA subsequently increased the OIT staff ceiling to 142 FTEs. 
However, TSA officials cited a human capital study conducted for DHS in April 
2004 that showed OIT supported roughly 350 users per FTE, whereas the 
average number of supported users per FTE among other federal agencies was 
approximately 50. According to TSA, OIT regularly requests increases to the 
FTE baseline but increases have not been approved to relieve this 
disproportionate FTE-to-user ratio. Further, in its response to this report TSA 
stated that OIT staffing has not reached its ceiling level with current staffing at 
116 FTEs. 

In addition, TSA stated that many studies have shown that its contracting office 
is equally understaffed. The ITMS contracting staff has grown from one 
contracting officer to the current staff of seven since contract award. Increasing 
the contracting staff level continues to be a focus area for TSA. 

Planned Versus Actual Costs and Deliverables - How do those actual services 
and products received compare to what was planned? 

Actual costs exceeded planned costs; and, TSA has not fully received essential 
planned deliverables. In the ITMS Acquisition Plan, OIT estimated costs to be $1 
billion over a seven-year period. However, TSA has spent nearly the entire 
amount in three years, but has not fully received all essential deliverables. TSA 
attributed most of its setbacks to budget cuts, under staffing, and changing as well 
as expanding requirements. Several TSA officials said that they never expected 
to complete all of the contract objectives within the original contract ceiling and 
originally estimated that the contract could cost between $3-5 billion, but set the 
contract ceiling at $1 billion. These same officials further explained that they 
were challenged to accurately estimate a contract ceiling because the staffing 
levels and complexity of the technology required to secure the entire U.S. 
transportation system were unknown when the ITMS Acquisition Plan was 
approved. In its response to our draft report, TSA said that it had specific 
requirements before the start of work and estimated the cost of those 
requirements at $1 billion. TSA was not, however, able to provide documentation 
on what specific requirements were included in the $1 billion ceiling. 
Consequently, we could not identify a clear basis for comparing estimated to 
actual costs for specific requirements. 

Planned Versus Actual Costs 

TSA's Acquisition Plan stipulated a $1 billion contract ceiling to cover a seven- 
year contract period. The estimate for the base period (FY 2003-2005) was $450 
million. However, OIT estimated that it spent $834 million (83 percent) just three 
years into the contract. The chart below compares TSA's planned contract 
expenditures for the base period with the actual contract costs. 
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Cumulative Planned Contract Costs Compared to Actual Contract 

Costs 

$1,000 -i 1 

$900 




Base Contract Period - 2003 to 2005 



Planned Versus Actual Deliverables 

TSA has not received many planned deliverables that are critical to airport 
security and communications. One example is High Speed Operational 
Connectivity (HSOC), which TSA planned to have fully installed by December 
31, 2002. TSA delayed HSOC deployment, however, when it did not receive full 
funding. Two years into the contract, 11 percent of large "hub" airports and 100 
percent of smaller "spoke" airports were still using dial-up connectivity. HSOC, 
or the "White Package," is the IT infrastructure that provides high-speed 
electronic connectivity and communications to all major airports. TSA originally 
scheduled HSOC for completion to all FSD sites by December 2002. TSA should 
have placed higher priority on completing this project because of its importance 
to airport security and communications, and because most other ITMS 
projects-such as time and attendance software, the screener scheduling software, 
and screener training programs-depend on it. 

Table 1 shows the status of the 12 essential planned deliverables from the 
contract. Appendix C provides additional details about these unmet deliverables, 
including assessments from OIT and our office. Twelve essential deliverables 
from this list were either overdue, or had no established due dates and were only 
partially delivered. FAR 37.601(a)(2) stipulates that performance-based 
contracting methods ensure that required performance quality levels are 
achieved, and requires the government to use measurable performance standards, 
including timeliness standards. OIT's acceptance of work proposals without 
planned delivery dates resulted in little control over when essential products and 
services were delivered. 
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Deliverable Description 4 


Orininal Planned 

i iu 1 1 mi i mi 1 1 iv u 

Delivery Date 


Has Project 

Rppn Fullv 
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Delivered? 


Reason for Delav 
(Per TSA) 


1 
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No 
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2 


Quality Control Surveillance Program 


No date promised 


No 


See Appendix C 


3 


Electronically enable employees 


Dec-2002 


No 


Lack of funding 


4 


Time and attendance system 

(KnUNUo) 


Dec-2002 


No 


Lack of funding 


5 


Scheduling system (SABRE) 


Dec-2002 


No 


See Appendix C 


6 


Interoperable land mobile radio services 


Aug-2003 


No 


See Appendix C 


7 
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No 
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8 


Integrated voicemail solution 


No date promised 


No 


Lack of funding 


9 


Sensitive but unclassified (SBU) 
capability 


Dec-2002 


No 


See Appendix C 


10 


Wireless solutions 


No date promised 


No 


Technology not 
available 


11 


Government Information Security 
Reform Act compliance 


No date promised 


No 


See Appendix C 


12 


Asset management 


No date promised 


No 


In progress 



TABLE 1 - Essential Deliverables not Fully Received 



We asked FSDs to rate the effectiveness of the goods and service received under 
the Unisys contract. Although the FSDs gave Unisys an average score of 7.3 on a 
scale of 1 to 10 (with 1 "poor" and 10 "excellent"), the FSDs submitted written 
comments complaining about products provided (see Appendix D for survey 
results). Many FSDs commented on ineffective email, voice mail, telephone 
service, cell phone service, Internet access, and LMRs. They also noted that the 
shortfalls were the result of inadequate funding rather than the fault of Unisys. 
The FSDs said that they need these key communication tools to ensure airport 
security. 

OIT attributed most of its setbacks to budget cuts within TSA (see Appendix C 
for details from OIT as to why some deliverables were not met). Table 2 presents 
OIT's budget requests, as well as TSA's allocations and cuts, from FY 2002 
through 2004 (in millions). 



No direct correlation between these deliverables and the work orders shown in Appendix B exists. All original contract deliverables were associated with 
Work Orders 1 and 2, but were later partially moved into other work orders. Therefore, we focused on key essential deliverables as shown in Table 1 and 
Appendix B. 
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Fiscal 
Year 


Requested 


Initial 
Allocation 


Final 
Allocation 


2002 


$238.2 


$108.2 


$108.2 


2003 


290.5 


269.5 


269.5 


2004 


406.1 


339.0 


262.7 


Total 


$934.8 


$716.7 


$ 640.4 



TABLE 2 - OIT Budget Requests and Allocations 



TSA cut the OIT FY 2004 budget three times after the initial allocation. OIT 
reported that these budget cuts resulted in delays on at least seven major ITMS 
projects. 



Performance Measures and Contract Performance - How is contractor 
performance under these task orders measured and how is the contractor 
performing under these measures? 

OIT did not establish or implement adequate performance measures at the 
beginning of the Unisys contract. Performance measures have evolved and 
improved over the life of the contract, but they were limited to a small portion of 
SRs and added too late in the contract process to have an impact. OIT has, 
however, made use of the limited performance measures available to indicate its 
lack of satisfaction with Unisys performance, awarding Unisys only 5 percent of 
the available performance award funds. 

Measurement Tools 

OIT implemented 19 tools to measure, monitor, and track performance on the 
Unisys contract (listed in Appendix E). However, 12 of the 19 tools came into 
use a full year after the contract was in place. Several of the tools were 
introduced only recently or never fully implemented such as the Quality 
Assurance Surveillance Plan. We reviewed five performance measurement tools 
on 27 SRs with incurred costs of $320 million as of August 30, 2004 and 
concluded that all five performance measures needed improvement. 



a. Acceptance Criteria - OIT did not define acceptance criteria for 24 of the 27 
SRs (89 percent). FAR 37.602-2 requires agencies to develop quality 
assurance surveillance plans that contain measurable acceptance criteria. 
Much of the work OIT placed on the Unisys contract did not include this 
basic requirement. Without setting specific acceptance criteria-including 
terms of quality, timeliness, and quantity-TSA cannot hold Unisys liable for 
timely delivery of acceptable products and services. When OIT implemented 
the new SR process, it should have required specific statements of work with 
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all the elements described for each SR. Instead, OIT allowed Unisys to work 
on projects without deadlines or acceptance criteria. 

We interviewed program managers for the 27 SRs about acceptance criteria. 
Managers for seven of the projects admitted that OIT had not defined 
acceptance criteria for its projects. Three project managers misunderstood 
how to define acceptance criteria. They said that a completed DD250 form 
denoted acceptance criteria. However, a completed DD250 simply indicates 
that a product or service was received on a specific date and that the 
government accepts it. OIT should have clearly defined acceptance criteria 
prior to awarding contract modifications, not after completion of the work. 

b. Service Level Agreements (SLAs) - SLAs are performance measures that 
gauge how well a contractor delivers services according to contractual 
requirements and customer expectations. For the first two years, OIT placed 
only 18 SLAs on this $1 billion contract. OIT admitted this number was 
insufficient because the SLAs covered only operations, maintenance, and 
security. Also, TSA's performance manager reported that five security SLAs 
were insufficient and irrelevant to important security issues, thus they were 
never used. On October 1, 2004, OIT revised the SLAs, eliminating eight and 
adding 24 for a total of 34. However, adding new performance measures two 
years, and over half a billion dollars into the contract, occurred too late to 
effectively measure performance. 

c. Performance Management Incentive Plan (PMIP) - OIT developed a PMIP to 
track and monitor contractor performance. However, because the original 
version was inadequate, OIT never fully implemented it. OIT made major 
changes to the plan and added it to the contract on October 1, 2004. The new 
version contained improved performance measures; however, two years into 
the contract, the PMIP was still evolving and was not fully implemented. 
Again, implementation of this measurement tool occurred too late to be 
effective. 

d. Earned Value Management (EVM) - EVM is a project management tool that 
effectively integrates the investment scope of work with schedule and cost 
elements for optimum investment planning and control. According to Office 
of Management and Budget (OMB) Circular A-l 1, Preparation, Submission, 
and Execution of the Budget, Section 300, Planning, Budgeting, Acquisition 
and Management of Capital Assets, EVM is required for those parts of the 
investment where developmental effort is required. Those "parts" include 
prototypes and tests to select the most cost-effective alternative during the 
planning phase, the work during the acquisition phase, and any 
developmental, modification, or upgrade work performed during the 
operational/steady state phase. EVM is to be applied to both government and 
contractor efforts. 



TSA's Information Technology Managed Services Contract 
Page 12 



According to the Circular, program managers must use EVM for ongoing 
investments to identify problems on specific work packages. OIT did not 
begin applying EVM until the last quarter of FY 2004, and then, only on a 
few projects. OMB representatives told us that EVM requirements were in 
effect as of FY 2002, that TSA is required to use EVM on the Unisys 
contract, and that TSA's business case would receive a less than satisfactory 
score if it did not use EVM on a project as large as the Unisys contract. The 
end result might be a program or budget cut, according to OMB. 

e. Independent Verification and Validation - OIT used a contractor to 
independently verify Unisys' performance and to determine whether 
measuring and reporting SLAs produced significant and accurate measures of 
performance. The contractor prepared detailed reports and recommendations 
for improving contractor performance. However, OIT has not implemented 
those recommendations. For example, SLA AVL-10 measured the 
availability of all servers across the Unisys contract. In a November 2003 
report, the contractor told OIT that the current measures of server availability 
were not a good indicator of whether actual services (files, e-mail, print, and 
applications) were available to OIT customers. The independent evaluator 
recommended that, as soon as feasible, OIT develop SLAs to measure 
availability of these services. In another example from the same report, the 
evaluator discussed SLA AVL-11, which monitors infrastructure 
maintenance, and the time Unisys takes to repair and return items such as 
laptops, desktops, and software applications to service. The evaluator could 
not unconditionally validate this SLA because documentation for contacting 
customers for repairs was inadequate. The evaluator recommended that OIT 
implement a documentation process to report the time it takes to make 
repairs. OIT provided no evidence that it had implemented any of these 
recommendations. According to senior OIT officials, OIT did not implement 
the recommendations because of a funding shortage. 

Awards 

The Unisys contract contains a clause to establish an award pool each FY 
quarter. As of September 30, 2004, TSA paid Unisys one $697,000 award (or 5 
percent) of an available $13.7 million pool, signaling that Unisys generally did 
not perform at a level sufficient to earn awards. 

Customer Satisfaction 

Many FSDs were dissatisfied with Unisys equipment and services. In our survey, 
we asked all 158 FSDs nationwide to rate Unisys' equipment and services. The 
FSDs' response rate (105 or 66 percent) shows their concern and frustration with 
ITMS goods and services. Table 3 summarizes common issues reported by FSDs 
and Appendix D lists a sample of FSD comments expressing dissatisfaction with 
Unisys' equipment and services. 
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Number of FSDs 




Common Issues Reported by 
FSDs 


Reporting this 
Issue 


Percent of 
Respondents 


Help Desk Ineffective/Slow 


31 


30% 


Need More Local Control of IT 


27 


26% 


Cell Phones Ineffective 


26 


25% 


Plain Old Telephone Service 
(POTS) is Ineffective 


22 


21% 


Local IT Support Needs 
Improvement 


20 


19% 


Land Mobile Radio Equipment 
Ineffective 


14 


13% 


Overall ITMS Needs Not being Met 


13 


12% 


Copiers/Fax Ineffective 


12 


11% 


Email Slow and Cumbersome 


10 


10% 



TABLE 3 - Common Issues Reported by FSDs 



4. Appropriate Use of Small Business - How does TSA ensure appropriate use of 
small businesses? 

Unisys use of small businesses is appropriate. Although the ITMS contract has 
no specific small business subcontracting requirements for Unisys, it 
incorporates Unisys' Commercial Subcontracting Plan that uses goals across all 
of its government contracts without specific small business subcontracting goals 
for individual government contracts. TSA has taken an aggressive approach to 
ensure that Unisys complies with small business subcontractor management 
responsibilities, even though it is not contractually obligated to any specific 
goals. 

5. Appropriate Use of New Technology - How does TSA ensure appropriate use 
of new technology through this contract? 

TSA has not provided new technology at airports. During our site visits to four 
airports and from responses on survey questionnaires from 105 airports, we 
learned that many FSDs were dissatisfied with the technology provided under the 
Unisys contract. OIT officials described two methods that were available to 
ensure the use of new technology, both through the SR process: 

a. Unisys knows it can propose new technology at any time for any service 
request. Unisys updates products as needed to keep current with what the 
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market has to offer. The contracting office makes product changes based on 
the availability of new technology. 

b. When OIT negotiates a new service request, OIT asks Unisys for a solution. 
Prior to acceptance, OIT program managers thoroughly evaluate Unisys' 
technical proposals. According to OIT officials, Unisys and the OIT program 
managers continuously research the market for the latest technology. 

Despite these options, many airports were operating with old technology, relying 
on dial-up Internet, and using email connectivity that was slow and ineffective. 
Telephone systems were often archaic without the capability to forward, hold, or 
conference calls. Land mobile radios did not have enough repeaters to ensure 
reception throughout airport properties and were not interoperable with other law 
enforcement agency equipment. 

Conclusion 

In 2002, TSA started the rollout of security operations at airports under 
congressionally mandated short timeframes with significant budget constraints. 
TSA had to quickly establish an information technology and telecommunication 
infrastructure needed to support its employees at headquarters and airport 
locations across the United States. To accomplish this challenging task, TSA 
awarded a $1 billion contract to Unisys using a broad statement of objectives to 
describe the requirements. At the time of award, the TSA OIT and Contracting 
Office had small staffs overseeing numerous high value acquisitions, including 
the Unisys contract. 

The broad scope of requirements and short timeframes for implementation 
caused difficulty in establishing a realistic contract cost ceiling, structuring 
specific tasks and establishing reasonable prices for those tasks. These 
difficulties impeded TSA's effective management of the Unisys contract and 
resulted in a lack of IT capabilities and support for TSA locations. This lack of 
IT capabilities, according to some FSDs, diminished their ability to accomplish 
their mission. 

The original funding is almost exhausted but many airports still do not have basic 
information technology and a telecommunications infrastructure. Moving to a 
new acquisition strategy at this time will allow TSA to establish well-defined 
requirements, develop independent cost estimates for those requirements, and 
better manage the implementation of new technology. 
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Management Comments and OIG Analysis 



In our draft report, we recommended that the Assistant Secretary, TSA: 

1. Close out the current ITMS contract at the end of the base period (August 12, 
2005), without exercising the option for additional contract periods; and, re- 
bid the work using either an adequately funded SOO contract or a SOW 
contract with well-defined requirements. 

2. Implement procedures to ensure that future procurement actions include the 
following features: 

• Fair and reasonable pricing; 

• Avoidance of unauthorized contract work; 

• Establishment of acceptance criteria prior to contract award; 

• Timely and effective performance measurements to ensure acceptable 
quality contractor performance. 



TSA concurred with the recommendations and stated that it has taken appropriate 
actions to implement those recommendations. TSA has developed a new 
acquisition strategy for information technology services. This strategy identified 
some work previously performed by Unisys for immediate competition, and 
allows for future competition as opportunities are identified. On December 30, 
2005, TSA awarded a 'bridge' contract to Unisys that allows it to retain 
equipment leased under the current ITMS contract, and provide for the transition 
of ongoing projects. TSA said that the 'bridge' contract implements sound 
business practices and processes to address the weaknesses identified in our 
report. We consider the recommendations resolved and closed based on TSA's 
assurances that these actions are complete. 

TSA also provided technical comments on the report content. We considered 
those comments in the development of the final report and revised the report to 
include TSA's comments and clarify specific points where necessary. 

Appendix F includes TSA's comments in their entirety. 
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Appendix A 

Purpose, Scope, and Methodology 



Purpose - Our audit objective was to answer five congressional questions: 

1. How are the contracts and related task orders set up, including how much 
the government has paid and what services and/or products have been 
received? 

2. How do those actual services and products received compare to what was 
planned? 

3. How is contractor performance under these task orders measured and how 
is the contractor performing under these measures? 

4. How does TSA ensure appropriate use of small businesses through this 
contract? 

5. How does TSA ensure appropriate use of new technology through this 
contract? 

Scope - We conducted the audit between July 2004 and July 2005 under the 
authority of the Inspector General Act of 1978, as amended, and according to 
generally accepted government auditing standards. Our scope focused strictly 
on answering these questions and covered the contract through Modification 
1 10. The audit included incurred costs as of August 30, 2004, and estimates to 
complete on-going projects, and deliverables completed as of the beginning of 
FY 2005. We performed limited testing (sampled SRs) of the accuracy of 
incurred cost data provided by TSA and Unisys. We did not test the accuracy 
of other electronic data provided. 

We selected a judgmental sample of 27 Service Requests, which included the 
15 largest dollar projects (over $10 million) as well as 12 that were added as 
we learned about projects by attending OIT performance management 
meetings, conducting interviews, observing airport deliverables, and analyzing 
survey questionnaire results. We used the same sample to review projects for 
fair and reasonable pricing and performance measurement issues. 

Methodology - To answer the congressional inquiry, we reviewed and 
analyzed contracting and SR files, contractor sub-contract files, invoices, 
financial reports and databases, TSA policy and IT manuals, and 
miscellaneous file documentation. We interviewed TSA contracting 
personnel, department heads, program managers, and budget employees. We 
also attended OIT performance management meetings. 

We conferred with Defense Contract Audit Agency (DCAA) auditors who 
were conducting an audit of Unisys invoices for the ITMS contract and with 
an official at OMB. We reviewed previous audits and reviews conducted by 
the Government Accountability Office, DHS OIG, and TSA's Internal Affairs 
Office. 
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Appendix A 

Purpose, Scope, and Methodology 



We composed and sent a survey questionnaire to 158 federal security directors 
asking them to rate the products and services provided by Unisys. We also 
toured four airports and interviewed FSDs, Unisys on-site IT specialists, and 
TSA screeners and managers. 

We took the list of contract deliverables directly from Unisys contract 
attachments J-9 and J- 11 (Work Orders 0001 and 0002 Technical Proposals) 
and from contract Modification 0004, "A Proposal for Measuring ITMS 
Success." TSA's contracting officer confirmed that this list was an accurate 
representation of contract deliverables. We asked OIT officials to confirm 
whether each deliverable had been completed. 
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Appendix B 

Work Order Descriptions 



Work 
Number 


Work Order Descriptions 


1 


Enterprise Operations Center 


2 


Field/Headquarters Infrastructure Deployment 


3 


Land Mobile Radio, Electronic Surveillance & Wireless Systems 


4 


Enterprise Management 


5 


Applications 


6 


Time and Attendance (KRONOS) and Scheduling (SABRE) 
Applications 


7 


Cargo Applications 


8 


e-Gov Operating Platform 


9 


DHS IT Support Vehicle - Ends FY 04 


10 


DHS- US VISIT 


11 


DHS IT Support Vehicle - Beyond FY 04 
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Appendix C 

Contract Deliverables Not Fully Completed 



We provided a list of original contract deliverables to OIT officials to ascertain whether 
each deliverable was complete, and if not, why not. As shown in the table below, many of 
the essential deliverables were due by December 2002 and were still in progress or not 
delivered by the beginning of FY 2005. OIT's explanations are in Column D. If we 
disagreed with OIT's conclusions, the reasons are shown in Column D. OIT provided the 
following overview: 

Introduction - The ITMS contract with Unisys was intended to be a vehicle from which 
TSA could order the IT services that were required to meet TSA mission requirements. 
From the beginning, it was assumed that adequate funding would be made available in a 
timely manner to facilitate the capabilities and timeline as proposed within this vehicle. 
At time of award, TSA was going through a period of constantly changing requirements 
almost on a daily basis. This time of change due in part to the turmoil of standing up an 
agency, an IT office, lack of timely funding, and trying to meet congressional mandates 
was unforeseeable and greatly impacted our ability to execute as originally envisioned. 
These factors contributed to the numerous contract changes that were executed through 
the Service Request process and/or through the ordering of services when funding was 
made available. The majority of the deliverables that will be discussed below were 
affected by the factors as discussed above. Even though an expectation was set early on 
that these capabilities would be rolled out on a promised schedule, forces outside of 
OIT's control necessitated that the original planning needed to be modified to facilitate 
the constantly changed environment. 



A. Planned Contract 
Deliverables 


B. Service/ 

Product 
Delivered? 
(Per TSA) 


C. Service/ 
Product 

Delivered? 
(Per OIG) 


D. Reason for Non-delivery of Service 
or Product/O/G Comments 


1 . White Packaqe 

a. White Package to all CAT X (21) 
&CAT1 airports by 11/19/02 

b. LAN/WAN infrastructure 

c. Operational hosting center 
(Network Operations Center, WAN 
Operations Center, Security 
Operations Center) 

d. Encrypted LMR 

TSA "accepts" installation 

e. White Package to 122 
remaining "FSD" airports by 
12/31/02. 


In progress 


In progress 


a. & b. - This is still in process of being 
completed as funding permits. Total 
funding to meet these requirements has 
not been provided to complete this task. 

c. This was completed as identified above 

d. Encryption capable Land Mobile 
Radios have been fielded to all airports 

e. Total funding to meet these 
requirements has not been provided to 
complete this task. 
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Appendix C 

Contract Deliverables Not Fully Completed 



A. Planned Contract 
Deliverables 


B. Service/ 

Product 
Delivered? 
(Per TSA) 


C. Service/ 
Product 

Delivered? 
(Per OIG) 


D. Reason for Non-delivery of Service 
or Product/O/G Comments 


2. Quality Control Surveillance 
Proqram (QCSP) 

Implement a robust QCSP 


In progress 


In progress 


Initial QCSP was developed but not 
implemented. Subsequently, QCSP is 
being re-vamped based on the new SLA 
metrics, and the QCSP was to be 
implemented by the end of QTR 1 FY05. 
Interim QCSP was implemented by the 
OIT via the Quality Management 
monitoring process, IV&V and the OIT 
Project Control process. 


3. Electronically enable employees 
Each employee will have the IT 
support necessary to meet their 
basic "role" needs. 
Role-based: Staff=PC, e-mail, 
inter/intranet access, telephone, 
and other capabilities. 
Screeners=e-mail, inter /intranet 
access, electronic access for 
scheduling and benefits 
50% of employees by 1 1/19/02 
100% of employees by 12/31/02 


In progress 


In progress 


As equipment was fielded these accounts 
were provided to meet users 
requirements. Screener Accounts were 
provided as the training requirements and 
funding were made available to support 
these requirements. 

OIG Comment: Unisys has missed its 
deadlines for this project. 


4. Time and Attendance System 
Provide a Time and Attendance 
card reader device, installation and 
maintenance solution that are 
technically feasible and cost- 
effective which can be integrated 
with the TSA Transportation 
Worker Identification Card (TWIC). 


Yes 


No 


This program is still in the delivery 
stages. An initial capability was delivered 
in FY03 and is still in use. Lack of 
available funding has prevented the 
rollout of services to the maximum extent 
the program was developed to provide. 

OIG Comment: OIT scheduled this 
project for completion at all airports by 
12/31/02. However, as noted above, it is 
still in the delivery stages. 


5. FSD Staff Management 
(Scheduling System (SABRE) 
Ability to acquire, assign, and track 
employees. 

a. Electronic database of staff 
available and fully-trained to assign 

b. Electronic ability to assign staff 
to shifts at least 3 weeks in 
advance 

c. Electronic ability to track staff 
time and attendance 

d. Electronic ability to pay staff for 
shift work performed 

e. 50% of employees by 1 1/19/02 

f. 1 00% of employees by 12/31/02 


In progress 


In progress 


This capability was fielded according to 
TSA requirements that continued to 
evolve post contract award. Both TSA 
and Unisys modified this original 
schedule through the SR process to meet 
TSA's mission requirements. 

OIG Comment: As noted in column A, 
100% SABRE was originally scheduled 
for completion by 12/31/02. 
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Appendix C 

Contract Deliverables Not Fully Completed 



A. Planned Contract 
Deliverables 


B. Service/ 

Product 
Delivered? 
(Per TSA) 


C. Service/ 
Product 

Delivered? 
(Per OIG) 


D. Reason for Non-delivery of Service 
or Product/O/G Comments 


6. Land Mobile Radios 
Provide secure, interoperable 
Land Mobile Radio Services to our 
customers. 


Fulfilled 


No 


LMR system provided to TSA to support 
its requirements. 

OIG Comment: Many FSDs reported that 
their LMRs do not work across the entire 
airport property and are not interoperable 
with other law enforcement agencies' 
equipment. 


7. Electronic Surveillance System 
Provide an Electronic Surveillance 
System (ESS) 


Fulfilled 


No 


ESS is an ongoing program to deploy a 
pilot to several airports to test the 
feasibility of the system. Upon a 
successful pilot and when funding is 
identified, the Electronic Surveillance 
System will be deployed to the required 
TSA field Sites. 

OIG Comment: This system has not 
been deployed to the required TSA field 
sites; therefore, it cannot be considered 
fulfilled. 


8. Inteqrated Voicemail System 
Implement an integrated 
voice/voicemail solution including 
dialing plans that are 100% 
interoperable with all Field/HQ 
nodes and equipment. Provide a 
migration path to Unified 
Messaging capability. 


In progress 


In progress 


Voice over IP (VoiP) was deployed to 
HQ. Budget constraints forced a 
reduction of deployed sites. Alternative 
systems were provided to airport sites 
that did not receive VoIP. The VoIP 
program has been restarted to try and 
fulfill this requirement. 

OIG Comment: This item has only been 
deployed to HQ. 


9. Classified Capability 
TSA ability to manage crises- 
Ability for TSA to alert and 
communicate with appropriate 
employees in the event of national 
or regional events. 

a. Command and Control 

b. FSD Crisis Participation 

c. 158 FSD airports with 
classified/Sensitive But 
Unclassified (SBU) capability by 
11/19/02 

d. All airports with classified/SBU 
capability by 12/31/02. 


In progress 


In progress 


This requirement continued to evolve 
after contract award to the present 
capability of FSD being able to 
communicate in a timely manner with the 
Transportation Security Operations 
Center. 
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Appendix C 

Contract Deliverables Not Fully Completed 



A. Planned Contract 
Deliverables 


B. Service/ 

Product 
Delivered? 
(Per TSA) 


C. Service/ 
Product 

Delivered? 
(Per OIG) 


D. Reason for Non-delivery of Service 
or Product/O/G Comments 


10. Wireless Solutions 
Provide coordinated wireless 
solutions consistent with 
operational need and consistent 
with TSA Enterprise Architecture. 


In progress 


In progress 


The multiple variables at airports have 
required TSA to wait for technology to 
catch up to its need to have an extremely 
secure system that can meet the many 
varied laws, regulations, and codes that 
are imposed upon TSA by the numerous 
airport authorities. 


1 1 . Government Information 
Security Reform Act Compliance 
(GISRA) 

Implement established GISRA 
compliance/review processes 
throughout the TSA Enterprise. 


In progress 


In progress 


GISRA has been superseded by Federal 
Information Security Management Act 
requirements and this is being met with 
the joint support of the TSA Security 
Office and Team Unisys. 


12. EOC Deployment 
Development of all Enterprise 
Operations Center related (EOC) 
deployment (services or 
equipment) packages coordinated 
with all TSA stakeholders and 
consistent with higher mission 
schedules and IT security 
requirements. Includes asset 
management. 


Completed 


No 


Task was completed based upon stand- 
up of the EOC and site visits by TSA 
security, infrastructure, and operations. 

OIG Comment: This deliverable includes 
asset management. Airport FSDs 
reported that Unisys has not delivered 
this yet. 


13. Balanced Scorecard 
Balanced scorecard to define the 
consolidated components of 
Performance Plan. 


In progress 


In progress 


TSA is still developing its approach to a 
balanced scorecard based upon OIT 
Strategic Objectives. 


14. LAN/WAN/VPN 
Provide TSA LAN and WAN 
connectivity, Internet access, VPN 
capability, and the servers and 
applications that make up the core 
foundation of those networks and 
are architected to optimize 
information security, total security, 
total cost of ownership, reliability, 
and user satisfaction in meeting 
TSA objectives. 


Provided 


No 


This was implemented to the maximum 
extent possible under the funding 
provided by TSA. Insufficient funding was 
provided to complete the installation of 
LAN/WAN connectivity to all TSA Sites. 

OIG Comment: This was not fully 
implemented due to funding constraints. 


15. Total Cost of Ownership (TCO) 
Develop and maintain TCO 
consistent with scope of the TSA 
IT infrastructure, configuration 
management, and TCO benefits. 


In progress 


In progress 


This is maintained at several levels 
consistent with standard government 
practices and is evaluated through the 
individual SR proposals and 
accomplished through the "estimate to 
complete" reviews. 
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Appendix C 

Contract Deliverables Not Fully Completed 



A. Planned Contract 
Deliverables 


B. Service/ 

Product 
Delivered? 
(Per TSA) 


C. Service/ 
Product 

Delivered? 
(Per OIG) 


D. Reason for Non-delivery of Service 
or Product/O/G Comments 


16. Enterprise and Security 
Architecture 

Immediate participation in the 
creation and maintenance of the 
TSA enterprise and security 
architecture planning and 
compliance process and TSA 
capital planning and portfolio 
management process. 


In progress 


In progress 


Unisys is helping TSA to develop 
enterprise and security architectures 
under the auspices of Work Order 4. 
Initial efforts have been completed and 
delivered. OIT has an Enterprise 
Architecture, Technical Reference Model, 
and Security Architecture. Capital 
Planning and Portfolio Management is 
under development at this time. 


17. On-site IT Support 
Provide on-site support at critical 
CAT X, CAT I airports, Federal Air 
Marshall, and other locations 
designated by TSA. 


Yes 


No 


On-site technical support at select 
locations for the Federal Security Director 
and subordinate staff to assist with 
network administration activities, system 
security, training needs, and related 
technical work and coordination as 
required. 

OIG Comment: Only 36 of the 4 1 
Category 1 airport FSDs responding to the 
OIG survey reported that they have on- 
site IT support. 
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Appendix D 

Federal Security Director (FSD) Survey 
Questionnaire Results 



TSA has deployed various levels of ITMS goods and services to 
429 airports. We sent a survey questionnaire to 158 federal 
security directors (FSDs) and received responses from 105, or 66 
percent (most FSDs are responsible for more than one airport). We 
asked the FSDs to rate the products and services they are receiving 
from Unisys on the ITMS contract. 



FSDs were asked to r 
1 to 10, with 1 "poor" a 
averai 


ate the following goods and services on a scale of 
nd 10 "excellent". The figures below represent the 
ge of the 105 responses received. 


Cell 
Phones 


E-mail 


Help 
Desk 


Radios 


Copiers/Fax 


Land 
Phones 


On-Site 
Tech 


Overall 
Rating 


7.1 


7.9 


7.5 


7.4 


8.4 


6.8 


7.7 


7.3 



In many cases, although the FSDs rated the item satisfactorily, they 
included narrative comments that contradicted the numerical 
rating. The following are notable comments from dissatisfied 
FSDs: 



1. "With no on-site service, response is slow, resulting in loss of 
productivity when computers go down. Inflexibility in adding 
peripherals to the system (printers) also reduces productivity. 
Technicians usually do not have any working knowledge of the 
programs they are attempting to fix and end up spending most of 
their time on the phone with the helpdesk. We could be just as 
effective with an administrative password and the helpdesk and 
save thousands of dollars per service call." 

2. "Radio equipment provided by Unisys does not provide adequate 
coverage of all areas serviced by TSA at the airport. Request for a 
repeater has not been met due to lack of TSA funding. An off-site 
contractor provides local Unisys technical support. The contractor 
provides good support but equipment is sometimes deadlined 
awaiting arrival of contractor. On-site dedicated support is 
necessary." 

3. "Much of what is handled by UNISYS can be better performed by 
in house employees at little or no cost to the government. For 
example, last year we needed to upgrade Adobe Acrobat. This is a 
routine upgrade performed by consumers everywhere in the world. 
Unfortunately, under the UNISYS contract it required a UNISYS 
rep to visit each work station to upgrade the software, because no 
one on my staff was authorized administrative privileges." 
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Appendix D 

Federal Security Director (FSD) Survey 
Questionnaire Results 



4. "The Help Desk is far from helpful. Although the service has 
improved over the last year, there are many times when you are 
sent the wrong template document, they refer you to departments 
or people that don't exist, or they will argue with you when you are 
trying to explain what is really needed to fix the problem at your 
location. We have had open jobs for weeks with no follow-up or a 
date when a field tech will be out to fix the problems." 

5. "Overall, UNISYS is providing 'reasonably' good service for this 
Directorate. Email service is rated low only because Red Package 
support is not deemed as acceptable service to meet the expected 
pace of TSA. Understanding that this is largely a money issue, all 
airports should still have a better baud modem rate than 30-46K! 
This FSD is scheduled for higher speed connectivity at its off-site 
headquarters before the end of November 2004, but services at all 
eight of our airports will remain on the Red Package for an 
undetermined amount of time. Our concern is that service will 
decrease with dwindling Red Package assets and service, and this 
is a topic that requires immediate address." 

6. "Inadequate number of cell phones available to core staff and 
managers. White package not at all locations. Radios are 
inadequate to the tasking. Not all divisions are in possession of fax 
machines (Regulatory, training, etc.) I am not satisfied that we 
have properly equipped all our management staff with proper 
desktop and cellular communications. My training staff is a very 
busy one and does not have a fax machine. My Regulatory 
operation should have a proprietary fax machine and does not. 
Proper printing equipment is not available to all operations for all 
aspects of their requirements. There is a problem with a print 
queue for some printers that should be fixed by TSA HQ and is 
being neglected." 

7. "Very important that we get [this airport] on the white package as 
soon as possible. Both the Deputy FSD and ASI are assigned to 
this location and they are significantly handicapped due to the slow 
and unsatisfactory performance of the old "red" package system. 
Numerous inquiries into a timetable for their white package 
installation have provided very little information." 

8. "We are not pleased with the level of services provided as the 
services are not state of the art and in fact are archaic." 

TSA's Information Technology Managed Services Contract 
Page 26 



Appendix D 

Federal Security Director (FSD) Survey 
Questionnaire Results 



9. "The areas for improvement are: 1) [this airport] needs a decent, 
reliable, modern office phone system and equipment. We were 
given a hodge-podge of $20 Radio Shack sale rack phones with 
which to conduct business. Many do not have common office 
features like speakerphone, hold, transfer, inter-com or re-dial 
capabilities. Some are so old they actually have a mechanical bell 
that rings when someone is calling. 2) The other major item in 
need of some attention is radio service. We have thousands of 
dollars worth of radio equipment to use, but do not have a repeater 
that will boost the signal to all corners of the airport. Sometimes 
people on the same concourse can't even communicate with each 
other. This needs to be fixed. For emergencies, we need a robust 
radio system that will work anywhere inside the terminal building 
and outside the building up to 1-2 miles (end of runway, around 
entire perimeter). 3) Next, it is essential that we get connectivity at 
the airport terminal (we have T- 1 line at the office off airport) in 
some way, shape, or form. Our Managers and Supervisors have to 
enter large amounts of data into a computer then connect via a dial 
up connection. This takes a long time and keeps them from being 
as efficient as they could/should be. A T-l line has been installed 
at the airport, but no cable has ever been strung to the manager's 
office or other locations nor has a server been installed to connect 
airport personnel to TSA systems. 4) Lastly, the "Lanier" copiers 
are good but have not been configured to the LAN in order to take 
advantage of all their advanced capabilities." 

10. "Telephone equipment is very basic. Need a phone system with 
many more options. Need to be able to put callers on hold, answer 
any line from any office and have speaker phone capability." 

11. "Initial roll out and set up of equipment worked well. However, 
when problems occur with equipment, the help desk is the first 
entry point to resolve the problem. Often, the tech at the help desk 
cannot solve the problem and a ticket number is assigned for an 
on-site visit. The local Unisys techs (not assigned to TSA) are not 
usually familiar with TSA networks and configurations and must 
also call the helpdesk during the visit to resolve issues. In addition, 
software is not on site and must be sent to the techs prior to the 
visit. This adds time to the repair process. We have experienced 
many trouble calls that result in the tech spending all day at the 
TSA office and still not resolving the problem. For example, 
Setting up two new laptops for our Aviation Security Inspectors 
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took almost two weeks. The tech had problems with the log in 
sequence for the dial-up capability and the "image" was reloaded 
several times." 

12. "We have a legacy closed circuit television system, several 
hundreds of thousands of dollars hanging from the roof of our 
checkpoint as a tool to use, that UNISYS cannot/will not maintain 
because it is not under the ITMS contract. We cannot even plug it 
in to our HSOC servers for connectivity. We're in a position to 
maintain it out of operational funds. This feels like fraud, waste, 
and abuse of government resources. Our airports still are working 
on dial-up and the HSOC package has not been deployed. Cell 
phones are limited to Verizon service, which has great coverage in 
the eastern United States but is not a premium service in the 
Northwest. The IT system itself is so overprotected that it's 
difficult to use, and I believe some people explore ways to defeat 
it, just to be able to use it - that is not good security. The IT system 
provided by UNISYS is serviceable for day-to-day operations - we 
get by. But it is largely 1980's technology being applied in 2005. It 
is limited in scope and ignores a large IT tool installed specifically 
to enhance security operations under the ATSA. Our IT system is 
in dire need of upgrade and the contract needs to cover everything 
in a manner that services our needs." 

13. "Local Unisys technician is outstanding but a second technician is 
needed because of the volume of work. White package is still not 
activated for most of the airport (awaiting a switch and rewiring 
since TSA has moved since spaces were first wired). There are no 
local file or web servers and only limited manual backups. 
Bandwidth is insufficient for planned HSOC rollout. We are 
unable to share intelligence information via network with other 
government agencies because of the refusal to allow secure 
external connectivity. LMRs remain unencrypted and monitored by 
the press and possibly others. There is no direct radio connectivity 
with other first responders for emergency coordination. Land 
telephone service is inadequate. We are leasing a large number of 
Plain Old Telephone Service lines at higher cost than a central 
exchange system and minimal functionality. There is no caller ID, 
ten-digit dialing is required for intra-office calling, and voice mail 
requires listening to the entire message before deleting. There is no 
way of determining how many voicemails are waiting. Telephones 
supplied are not ergonomic and have no speakerphone capability. 
There is no capability for announcement service - a feature that 
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was vital during the three hurricanes that struck the airport. 
Requests for additional lines take an excessively long time to 
approve." 

14. "Cell phone service has been spotty due to multiple dead spots 
throughout the airport. Help desk - prime to sub handoff and 
follow-up spotty in completing repairs. Radio Equipment - poor 
design, lack of repeaters at field limit effectiveness. Land 
telephone equip and service, not sure if this is due to funding or 
poor Unisys management, but it has taken two years to get our first 
land lines into the airport. Our support center has gotten two dial- 
up lines within the last 60 days, and baggage pods have gotten 
landlines within the past two weeks. There still is no landline 
capability for any checkpoint at any of our 7 terminals. Overall 
Unisys Performance - Many of our issues may be outside of the 
purview of Unisys (i.e. due to funding, TSA HQ decisions, etc.) 
however our overall satisfaction with telephones, computer 
connectivity, and general responsiveness on the part of Unisys is 
that they are below average as compared with other providers I 
have had experience with." 
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DESCRIPTION OF TOOL 


OBJECTIVES 


IMPLEMENTATION 

1 1 VI 1 1 VI 1 V 1 #» 1 1 | V 

DATE 


Independent Validation and Verification 


Monitor program accountability 


Jan-03 


Independent Monitoring of 
nrnnram^/nrniprt 1 ; hv rlp^innatprl 
Contracting Officer's Technical 
Representatives (COTRs) 


Ensure costs, schedule, and 
nprfnrmanrp arp in arrnrrlanrp with 

UCI IUI 1 1 IQI lUC CI 1 III QUUU 1 UQI Willi 

contract 


Jan-03 


TSA Investment Review Board 


Review of Project investment portfolio 


Jan-03 


TSA Information Technology Management 
Council 


Review of Project investment portfolio 


Jan-Oo 


Contractor Estimate To Complete reports 


Monitor financial accountability 


Mar-Oo 


Invoice Reconciliation 


Monitor financial accountability 


Mar-03 


Review of Service Orders 


Monitor financial accountability 


Mar-03 


TSA Change Control Board (CCB) 


Monitor change requirements 


Aug-03 


TSA Configuration Control Board (CCB) 


Monitor and track CCB issues 


Aug-03 


r_l lyil IfcJfcM II ILj ncVlcW DUcllU 


l\yir*n itr*r and frarlf ffR icci 10c 


Ai in-fl . 

r\uy uo 


SLAs 


Outline SLAs for performance 
management to contracts 


Aug-03 


Program Control Review of project 
expenditures 


Monitor financial accountability 


Sept-03 


Quality Assurance Surveillance Plan 


Monitor quality performance 


Oct-03 


Quad Charts 


Monitor and report on project 
performance-cost, schedule and 
performance 


Oct-03 


Budget Versus Expenditure Reports 


Monitor financial accountability 


Jan 04 


Performance Measure Reviews 


Assess SLAs, key performance 
indicators, business objectives and 
special project incentives as 
addressed in the QASP and PMIP. 


Feb-04 


Cost, Schedule, Performance Management 
Reviews 


Brief senior management 


Mar-04 


PMIP 


Monitor and report on performance 
measures on contract 


Oct-04 


Directors' Survey 


Provides a subjective review of the 
ITMS performance based on the 
PMIP 


Oct-04 
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JAN 1 8 2006 



Office of the Assistant Secretary 




U.S. Department of Homtland Security 
601 South 12th Street 
Arlington, VA 22202-4220 

Transportation 

Security 

Administration 



INFORMATION 



MEMORANDUM FOR: 



FROM: 



SUBJECT: 



J. Richard Berman 
Assistant Inspector General 
Department of Homeland Security 

Kip Hawley fcp J/ajt*r&ft~ 
Assistant Secretary^ (f 
Transportation Security Administration 



The Transportation Security Administration's (TSA) 
response to the Department of Homeland Security (DHS) 
Office of Inspector General (OIG) draft report titled "Audit 
of the Transportation Security Administration 's 
Information Technology Managed Services Contract with 
Unisys Corporation. " 



Purpose 

This memorandum constitutes TSA's response to the findings and recommendations made in the 
DHS OIG draft report, "Audit of the Transportation Security Administration 's Information 
Technology Managed Services Contract with Unisys Corporation " (September 2005). 

Background 

The DHS OIG performed a review of TSA's $ 1 billion contract with Unisys Corporation 
(Unisys) for Information Technology Managed Services (ITMS), This review was done in 
response to a congressional inquiry (dated June 1 7, 2004) from Congressman Don Young, 
Chairman of the House Committee on Transportation and Infrastructure. 

Discussion 

TSA has implemented several changes since the DHS OIG opened this audit and continues to 
make significant improvements within the Office of Acquisition, TSA appreciates the DHS 
OIG's efforts to account TSA's activities related to this report, and we look forward to an 
ongoing relationship with your office as we work towards identifying and correcting 
vulnerabilities in our transportation security infrastructure. 

Attachment 
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The Transportation Security Administration (TSA) Formal Response to the Department of 
Homeland Security (DHS) Office of Inspector General (OIG) Draft Report and 
Recommendations, "Audit of the Transportation Security Administration's Information 
Technology Managed Services Contract with Unisys Corporation" 

TSA has reviewed the draft report, Audit of the Transportation Security Administration 's 
Information Technology Managed Services Contract with Unisys Corporation, which was prepared 
in response to a request from Congressman Don Young. 

On December 30, 2005, TSA awarded the "bridge" contract to Unisys in accordance with our 
approved acquisition strategy to transition to the anticipated departmental solutions. The new 
contract has implemented sound business practices and processes to address the weaknesses 
identified in the subject report. As part of the strategy, TSA has identified work previously 
performed by Unisys to be immediately competed, and will continue to seek efforts for future 
competition. 

We appreciate the opportunity to comment and provide our input. TSA generally concurs with the 
recommendations; however, there are a number of areas within the report that require clarification. 

Contract Structure 

The draft report states that TSA awarded a Statement of Objectives (SOO) contract but shortly 
thereafter changed the contract structure to a Statement of Work (SOW) contract because the Office 
of Information Technology (OIT) did not receive anticipated funding. The report further states that 
TSA chose this approach due to Congressional time constraints. This is inaccurate. After careful 
market research to determine the best contract vehicle, TSA awarded a contract to Unisys based on 
an SOO. The use of an SOO is broadly recognized as a best practice for implementation of 
performance based contract management. The SOO provides the strategic information technology 
(IT) performance objectives of TSA. Subsequently, TSA negotiated an SOW at the work order 
level, which is part of the overall SOO contract, not a separate contract as stated in the report. This 
process, known as the Service Request (SR) process, enables TSA to analyze proposed solutions and 
determine whether the contractor's approach is technically acceptable and based on fair and 
reasonable costs. 

Planned vs. Actual Contract Cost 

When TSA was initially defining IT requirements, the scope of the proposed Information Technology 
Managed Services (ITMS) contract changed frequently. Since the requirements could not be 
completely defined at that time, a decision was made to freeze the requirements to allow critical work 
to commence. The cost of these requirements was estimated at approximately $1 billion. Therefore 
during the review period prior to award it was determined that the contract would have a ceiling set at 
$1 billion. 

TSA recognized that the magnitude of ITMS required flexibility and cost adjustment based on 
experience. The scope of the contract was appropriately broad and the structure accommodated 
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undefined requirements (through time and materials line items) with requirements for commercially 
available technology and services that could be priced on a firm fixed basis. However, TSA could 
not have anticipated the inclusion of IT requirements for the yet- to-be created DHS. 

Fair and Reasonable Pricing 

The Department of Transportation (DOT) determined that the Information Technology 
Omnibus II (ITOP II) prices were fair and reasonable. ITMS is a task order under ITOP II. 
It was awarded competitively, and the prices were again determined to be fair and reasonable 
at that time. In addition, TSA reviewed each service request for technical acceptability and 
determined that it was fair and reasonable based on the best information available. When proposal 
evaluators determined that the cost proposals included too much labor, the wrong type of labor 
categories, or the labor rates were high, the TSA team negotiated lower prices. 

Unauthorized Contract Work 

TSA has established a formal process, referred to as the "authorization to proceed process," to 
eliminate the occurrence of unauthorized work. There is no work being performed on the contract 
without formal authorization from the Contracting Officer. In most cases where Unisys performed 
work prior to authorization, invoiced costs were not accepted or paid. 

Performance Measurement Tools 

Unisys' performance has been continuously measured under the ITMS program. As the program has 
matured, the performance measurement program has evolved. Since the contract was awarded, the 
Performance Management Plan and Service Level Agreements (SLAs) have undergone two 
substantial revisions, and the performance measurement system is now based on current industry 
best practices. Further, under the program, incentive awards are made only when performance 
exceeds contractual requirements and objectives. For the 1 1 months that the current performance 
plan has been in place, the contractor has consistently been evaluated as meeting (but not exceeding) 
contractual requirements. Consequently, during that time, no incentive award was paid. The 
effectiveness of this program is illustrated by Unisys' performance ratings during the contract having 
steadily increased over the course of the performance program. 

According to Office of Management and Budget guidance, the Earned Value Management System 
(EVMS) policies for civilian agencies are required by the end of this calendar year. Following 
traditional project management best practices of planning using a work breakdown schedule (WBS), 
the ITMS team has included an EVMS provision in the Bridge Contract that allows the Government 
to properly manage baselines and control overall cost, schedule, and performance. The EVMS being 
implemented is based on the project level for projects over $500K and 6 months of effort. The 
contractor is to report at the second level of the WBS, while explaining variances over 10 
percent. The Government subject matter experts agree that standard reporting of performance from 
the contractor, based on project management best practices tied to a WBS and schedule, will provide 
necessary control and insight into each project without incurring significant cost or effort. 
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Customer Satisfaction 

TSA has tracked monthly customer satisfaction metrics, through follow up SPOC surveys that are 
based on a 5.0 likert scale. These monthly metrics are a compilation of daily follow-up calls in 
response to user support issues. The questions include responses based on promptness, 
courteousness, technical service, and problem solving. Using a response of 1 as the lowest 
(customer dissatisfaction) and 5 as the highest (customer satisfaction), TSA was able to identify 
potential areas for improvement and areas where support is satisfactory to TSA customers. The 
results to date indicate a customer satisfaction range from 4.69 to 4.85 on monthly statistics from 
October 2003 to October 2005 with an average rate of 4.78 on a 5.0 scale. Field surveys are 
conducted annually in addition to SPOC surveys. Data acquired during the past 3 years of field 
surveys indicate that in 2003 there was a score of 4.31, in 2004 a score of 4.25, and in 2005 a score 
of 4.30 on a 5.0 likert scale. 

Appropriate Use of Small Businesses 

In accordance with industry practice, TSA implemented the small business goals and subcontracting 
plan that was in effect under the Information Technology Omnibus II (ITOP II) contract. Under the 
terms of the contract, Unisys submits a Monthly Small Business Activity Report to the TSA Office 
of Small Business as well as the ITMS Contracting Officer (CO). This report identifies the 
subcontract, the type of business, and the total disbursements made to date for each business size 
category. TSA has placed significant emphasis on achieving small business goals since early in the 
contract. 

The TSA acquisition strategy for future IT contracts is in alignment with agency small business 
goals. The strategy also identifies specific requirements that will be set aside for small business 
prime contracts. 

Appropriate Use of New Technology 

TSA has driven significant technological enhancements to airports. Information resources and 
telecommunications were provided to a newly formed operation that included headquarters and 
airports for an estimated 65,000 employees. There was no existing IT infrastructure in place when 
TSA was formed. Initial operating capability at TSA locations included rapid deployment of cellular 
phones and laptops with a dial-up modem for e-mail and Internet access. To meet full IT 
requirements, TSA implemented the High Speed Connectivity (HSOC) program. In its first year, 
HSOC was implemented at 16 TSA field locations; this provided for a more stable, secure and 
better-performing IT environment. To date, HSOC has provided 160 Federal Security Directors 
(FSDs) with High Speed Access (100%), 2,140 Training Computers Networked (53%), 215 MPLS 
Technology Insertions (98% of deployed network), 2,550 Field VoIP Intelligent Phones, and 1,800 
Headquarter User Migrations (99%). Through its HSOC initiatives, TSA continues to upgrade 
connectivity to each airport and FSD location. This includes connectivity to all TSA controlled 
space, i.e., passenger checkpoints, baggage areas, training rooms, office spaces, and wide area 
connectivity to the TSA Hosting Center. Full deployment of HSOC will also provide VoIP 
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Intelligent Phones, migration to Windows XP and e-mail, and conformance to IT Architecture and 
Security standards. 

TSA Response to DHS OIG Recommendations: 

OIG Recommendation 1: Close out the current ITMS contract at the end of the base period 
August 12, 2005, without exercising the option for additional contract periods; and, re-bid the 
work using either an adequately funded SOO contract or a SOW contract with well-defined 
requirements. 

TSA concurs. TSA did not exercise the option period of the ITMS contract. TSA is currently in 
the process of negotiating a new bridge contract for portions of the IT services currently 
performed by Unisys. The TSA requirement was defined in a comprehensive statement of work 
developed by TSA and then further refined by using alpha negotiation techniques. Every 
possible scenario was considered regarding the acquisition of these services beyond the life of 
the existing contract, including competing the requirement outright. The solution developed and 
approved is a combination of continuing with Unisys for portions of the existing work for a short 
time (a bridge contract) until the Department establishes Department- wide acquisition vehicles, 
which will leverage the buying power of the 22 agencies within the Department, and competing 
other aspects of the requirement. 

A DHS initiative to consolidate the entire Department's and bureaus' IT requirements is 
anticipated to go into effect in the next 2 to 3 years. During the performance of this bridge, TSA 
intends to transition to those contracts when possible. Therefore, this bridge contract will ensure 
that there is no lapse in service while awaiting DHS's contract. Furthermore, TSA is designing a 
plan to break out "non-core" services and competitively award contracts to multiple vendors, 
including small businesses, to infuse competition into the process. These non-core requirements 
will include IT equipment purchases, wireless communication services, application development, 
and program management services and accounts for 
30 percent of the current effort. 

OIG Recommendation 2: Implement procedures to ensure that future procurement actions 
include the following features: 

■ Fair and reasonable pricing; 

■ Avoidance of unauthorized contract work; 

■ Establishment of acceptance criteria prior to contract award; 

■ Timely and effective performance measurements to ensure acceptable quality 
contractor performance 

TSA concurs. TSA has in place mechanisms to ensure all of the items cited above are 
achieving the desired objectives. All new proposals are being properly evaluated, negotiated, 
and documented in accordance with acquisition regulations and best practices. 

In order to ensure that TSA receives fair and reasonable pricing, certified cost and pricing 
data is required by TSA as part of the proposal on the bridge effort. TSA is performing a 
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technical evaluation of all labor and cost analysis while using Federal Acquisition Regulation 
part 15 as a guide, and the Defense Contract Audit Agency is auditing the cost proposal. 

To prevent unauthorized work, a fixed price contract for all CORE services will be awarded 
and any requests for new work will require a properly submitted procurement request 
package that contains a statement of work, an Independent Government Cost Estimate, and 
inspection and acceptance criteria. All new work will be fixed price to the maximum extent 
possible. 

The contract will contain inspection and acceptance criteria and SLAs to determine 
acceptable performance. TSA will use quarterly performance reviews to monitor 
performance. 

OIT is also realigning its contracting officer technical representatives to specific areas of the 
contract and will use technical monitors to ensure performance standards are achieved. 
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Son Soitttfj 
Cfiaicman 



Commttttt on tHrangportatitm ante Infrastructure 
SSaafitimffton, BC 20515 



3ameg 1. #itcBtar 
ftanfting ffiemocrattc itktnber 



June 17, 2004 



LLoyd A. J<mes, Chief of Staff 
Eliiabeth Hejglrwoa, Chief Counsel 



David Hejmsfeld, Democratic Chief of Sutf 



The Honorable Clark Kent Erving 
Inspector General 

U.S. Department of Homeland Security 
Washington, D.C. 20528 

Dear Mr. Erving: 

Procurement and contract management at the Transportation Security Administration 
(TSA) remains a subject of continued concern for the Committee on Transportation and 
Infrastructure. In addition to general concerns, the Committee is specifically interested in one of 
TSA's contracts with Unisys Corp. That contract number is DTSA20-02-D-00485 and is 
referred to as the Information Technology Managed Services Program (ITMS). 

The Committee's questions regarding this contract include management from the 
program office and oversight from the procurement office. We would like to know how the 
contract and related task orders are set up, including how much the government has paid and 
what services and/or products have been received. We would also like to know how those 
"actuals" compare to what was "planned". We are also interested in how contractor performance 
under these task orders is measured and how the contractor is performing under these measures. 
Finally, the Committee wants to understand how TSA ensures appropriate use of small 
businesses and new technology through this contract. To answer these questions, I am 
requesting the Office of Inspector General to review and audit this contract. 

If you have any questions about the Committee's interest on this issue, please contact 
Bob Faber, Senior Counsel, Oversight and Investigations at; (202) 225-5504. I appreciate your 
time and attention to this matter. ■ ■ 
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To obtain additional copies of this report, call the Office of Inspector General 
(OIG) at (202) 254-4100, fax your request to (202) 254-4285, or visit the OIG 
web site at www.dhs.gov. 

OIG Hotline 

To report alleged fraud, waste, abuse or mismanagement, or any other kind 
of criminal or noncriminal misconduct relative to department programs or 
operations, call the OIG Hotline at 1-800-323-8603; write to Department of 
Homeland Security, Washington, DC 20528, Attn: Office of Inspector 
General, Investigations Division - Hotline. The OIG seeks to protect the 
identity of each writer and caller. 



